diff --git a/mongoose.c b/mongoose.c
index f95bb4b9..283e98f5 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -468,6 +468,7 @@ static struct mg_dash_user *mg_dash_authenticate(struct mg_http_message *hm,
       MG_DEBUG(("Deleting expired auth %s/%d %llu %u", u->name, u->level,
                 u->expire, mg_millis() - u->expire));
       LIST_DELETE(struct mg_dash_user, &s_users, u);
+      mg_free(u);
     }
   }
 
diff --git a/src/dash.c b/src/dash.c
index a5c2bab7..bebbe3d1 100644
--- a/src/dash.c
+++ b/src/dash.c
@@ -347,6 +347,7 @@ static struct mg_dash_user *mg_dash_authenticate(struct mg_http_message *hm,
       MG_DEBUG(("Deleting expired auth %s/%d %llu %u", u->name, u->level,
                 u->expire, mg_millis() - u->expire));
       LIST_DELETE(struct mg_dash_user, &s_users, u);
+      mg_free(u);
     }
   }
 
diff --git a/test/unit_test.c b/test/unit_test.c
index 32bfdfe1..1af00d2a 100644
--- a/test/unit_test.c
+++ b/test/unit_test.c
@@ -4305,6 +4305,7 @@ static void test_dash(void) {
   char marker = 0;
 
   memset(&dash, 0, sizeof(dash));
+  dash.session_auto_expiration_seconds = 1;
 
   MG_DASH_ADD_FIELD_SET(&dash, &set1);
   ASSERT(dash.sets == &set1);
@@ -4461,6 +4462,10 @@ static void test_dash(void) {
                "Authorization: Basic YWRtaW46YWRtaW4=\n\n") == 200);
   ASSERT(cmpbody(buf, set1_expected4) == 0);
 
+  mg_delayms(1100);
+  ASSERT(fetch(&mgr, buf, url, "GET /api/hi HTTP/1.0\n\n") == 200);
+  ASSERT(cmpbody(buf, "hi\n") == 0);
+
   mg_mgr_free(&mgr);
 }